Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
Tags
73 pages
Go
What survives a port, and what doesn't
Porting a Go framework to Rust separates design from idiom. Which decisions survived the move, which were habits, and how to tell them apart.
rust-tool-base: the same idea, in a language that argues back
A sibling to go-tool-base rather than a port, filling the gap between excellent Rust crates and a coherent way to assemble them.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
Where should a CLI keep your API keys?
Credential storage for a Go CLI: an env-var reference by default, an opt-in OS keychain, and plaintext only as a last resort and banned in CI.
A configurable AI endpoint is an attack surface
A user-settable AI base URL decides where your API key gets sent. Validating it to reject userinfo, non-HTTPS schemes and redirects.
Redacting the secret you didn't know was in the string
Catching secrets by shape rather than by name: patterns for provider key prefixes, URL userinfo and auth headers, plus a fuzzy fallback.
I had the framework audited: every finding was the same shape
Every finding in a security audit reduced to untrusted input reaching a powerful operation unchecked. One checked chokepoint per boundary fixes it.
A mutex on a flag nobody writes twice
Why a write-once boolean still needs a mutex: the Go memory model needs a happens-before edge before another goroutine is guaranteed to see it.
The test-mocking pattern that races
Reassigning a package-level function variable in tests is a latent data race that t.Parallel exposes. The fix is structural, not another lock.
